channelstorage_cpp: Fix fallback return value in channelstorage callback

callback returned the last iterated channel when no match existed, causing invalid channel references and potential double frees. Updated to correctly return NULL when there is no match.

Resolves: #1609

diff --git a/main/channelstorage_cpp_map_name_id.cc b/main/channelstorage_cpp_map_name_id.cc
index d4b42f3bf5328b9a66bd3663b7909a56751cd437..dfbfbb9a92ac547aed7259a77aaa035c986f5602 100644 (file)
--- a/main/channelstorage_cpp_map_name_id.cc
+++ b/main/channelstorage_cpp_map_name_id.cc
@@ -172,9 +172,8 @@ static struct ast_channel *callback(struct ast_channelstorage_instance *driver,
                rdlock(driver);
        }
        for (it = getdb(driver).begin(); it != getdb(driver).end(); it++) {
-               chan = it->second;
-               if (cb_fn(chan, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
-                       ao2_bump(chan);
+               if (cb_fn(it->second, arg, data, ao2_flags) == (CMP_MATCH | CMP_STOP)) {
+                       chan = ao2_bump(it->second);
                        break;
                }
        }